CVE-2007-3013 SQL injection vulnerability in activeWeb contentserver before 5.6.2964 allows remote authenticated users with edit permission to execute arbitrary SQL commands via the id parameter to admin/picture/pi...
MediumCVSS 6.5
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in activeWeb contentserver before 5.6.2964 allows remote authenticated users with edit permission to execute arbitrary SQL commands via the id parameter to admin/picture/picture_real_edit.asp, and probably other unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| activeweb contentserver | <= 5.6.2929 | No fix listed |
References
- 26063 third-party-advisory
- 36511 vdb-entry
- www.redteam-pentesting.de exploit patch vendor-advisory
- 20070713 ActiveWeb Contentserver CMS SQL Injection Management Interface mailing-list
- 24894 exploit vdb-entry
- activeweb-picturerealedit-sql-injection(35390) vdb-entry